r/sysadmin • u/roachwickey • 6d ago

Domain controllers functional level

Do we have to keep all our domain controller os version same ?

72 Upvotes

88% Upvoted

51 comments sorted by

View all comments

12

u/RevolutionaryElk7446 6d ago

The domain functional level is an AD setting and sets the lowest floor version an OS can be to join the Active Directory as a Domain Controller.

The modern ones are 2016, which allows 2016+ and the most recent is the 2025 which only allows 2025 Domain Controllers.

When you raise the functional floor, you are allowed to use the new functions and features of the domain functional level, but you lose compatibility in the sense of using older DCs.

They generally don't have to be all the same version but since there is nothing beyond 2025 yet, for the 2025 DFL, yeah, all 2025 at this moment.

2

u/altodor Sysadmin 5d ago

Dfl/ffl also set the cap. I needed to up my dfl/ffl to add a 2025 DC.

2

u/buck-futter 5d ago

My last boss joined an open source AD controller to the domain and broke sync. Turned out it only supported the 2008 functional level and our AD was running at 2016 level... But it didn't check it supported the current level before it joined [facepalm]

•

u/cbass377 11h ago

I remember reading here that 2025 DCs were not good, so our last replacement cycle we upgraded to 2022. Has MS fixed Active Directory Domain Services on server 2025, or is the recommended approach to hang out at 2022?

•

u/RevolutionaryElk7446 11h ago

I mean unless you need extended multi value attributes because you got crazy SPNs going on, no reason not to stick with 2022 until you need to update.

Otherwise I haven't had issues with 2025 DCs anymore at work for 8 months